I just started getting a warning from my malware detector that when I start
Excel there is an attempt by MSOHTMED.exe to modify the registry. Why is
this suddenly happening? Is it an indication of a security breach?

I found this on the Web:

msohtmed.exe is used for printing HTML files

It's a legitimate part of Office. Why it might be changing the
Registry, I don't know. Is there HTML in a workbook you're opening?

Do you know just what the app is modifying in the Registry?

Mark Lincoln wrote:
I found this on the Web:

msohtmed.exe is used for printing HTML files

It's a legitimate part of Office. Why it might be changing the
Registry, I don't know. Is there HTML in a workbook you're opening?

Do you know just what the app is modifying in the Registry?

-------------------------

If one has a bit of paranoia (not entirely bad on the web) you also have to
wonder whether msohtmed.exe is the real Microsoft file, or something insidious
that has taken the name of a known Microsoft file to escape being purged.

Presumably he still has an original copy of the file on his distribution disk to
verify whether it's been tinkered with by evil doers.

Bill

MC, Bill has a good point. If you're running WinXP, you can run the
System File Checker, which can replaced damaged or hacked systems files
with their original versions. Go to "Run" and type in "cmd" (without
the quotes) to get a command prompt. Then type "sfc" (again, no
quotes) for a list of options.